Hasura

v2.49.5 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 6d API Development

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

access-control api automatic-api bigquery graphql graphql-server

+8 more

haskell hasura mongodb postgresql rest sql-server subgraph supergraph

Affected surfaces

deps

Summary

AI summary

Server upgraded Ubuntu/UBI images, added JSONB path filter operators, Console fixed null TypeError and allowed all columns on update, CLI updated Go to address security vulnerabilities, Data Connector bumped dependencies to remediate high‑severity CVEs.

Full changelog

Changelog

This is a patch release for v2.49.

Bug fixes and improvements

Server

Upgrade Ubuntu base images to 24.04). The standard support of Ubuntu 22.04 will end on June 2027.
Upgrade UBI base image to v10 to up-to-date with Ubuntu 24.04. GLIBC_2.38 is supported in UBI v9.
Error responses now include the x-request-id header, matching successful responses so clients can correlate failures with logs and traces.
add jsonb path filter operators _jsonb_path_exists and _jsonb_path_match

Console

Fix TypeError when experimental_features is null in useRootFieldPermissions.ts
allow selecting all columns when updating trigger operation

CLI

cli: upgraded Go v1.26.5 and dependencies to address known security vulnerabilities reported.

Data Connector

Bump jackson-databind (2.21.4) and Netty (4.1.136.Final) in the super-connector data connector to remediate HIGH severity CVEs (CVE-2026-54512, CVE-2026-54513, CVE-2026-44891).

Build

Remove the unused default ssl-cert-snakeoil private key and certificate from the graphql-engine ubuntu base image so they are no longer shipped in the container filesystem.

Security Fixes

Data Connector: Bumped jackson-databind (2.21.4) and Netty (4.1.136.Final) to remediate CVE-2026-54512, CVE-2026-54513, CVE-2026-44891
CVE-2026-54513
CVE-2026-44891

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Hasura

Get notified when new releases ship.

About Hasura

Fast, instant realtime GraphQL APIs on Postgres with fine grained access control, also trigger webhooks on database events.